Dd Trace Php
Monthly
Unbounded CPU and memory consumption in the Datadog PHP Tracer (dd-trace-php) before 1.19.2 allows remote, unauthenticated attackers to exhaust resources on any instrumented PHP worker that parses W3C baggage headers. The tracer's baggage deserializer fails to enforce DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES, so a request carrying an arbitrarily long list of comma-separated key-value pairs, or a single oversized value, forces unbounded hash-map allocation and parsing work on every request; because baggage extraction is enabled by default in most deployments, exposure is broad and pre-authentication, though the impact is limited to availability with no confidentiality or integrity effect. No public exploit code has been identified at time of analysis, and the vendor has released a fix in 1.19.2 (with 1.20.0 also containing the change).
Unbounded CPU and memory consumption in the Datadog PHP Tracer (dd-trace-php) before 1.19.2 allows remote, unauthenticated attackers to exhaust resources on any instrumented PHP worker that parses W3C baggage headers. The tracer's baggage deserializer fails to enforce DD_TRACE_BAGGAGE_MAX_ITEMS and DD_TRACE_BAGGAGE_MAX_BYTES, so a request carrying an arbitrarily long list of comma-separated key-value pairs, or a single oversized value, forces unbounded hash-map allocation and parsing work on every request; because baggage extraction is enabled by default in most deployments, exposure is broad and pre-authentication, though the impact is limited to availability with no confidentiality or integrity effect. No public exploit code has been identified at time of analysis, and the vendor has released a fix in 1.19.2 (with 1.20.0 also containing the change).